Feature Enhancements

The Cortex XDR 3.15 release includes the following enhancements:

General

FEATURE	DESCRIPTION
Linux Kubernetes Platforms	Support added for Google Kubernetes Engine (GKE) Autopilot
German healthcare data control with Cortex XDR Cloud	Maintaining control of data privacy and security for the public sector and regulated industries in Europe, Cortex XDR cloud region for Germany supports strict data privacy and service localization controls.

API

FEATURE	DESCRIPTION
Create Distributions API now supports Kubernetes installations	The Create Distributions API now supports Kubernetes installations, helping you automate and streamline the deployment of the agent in Kubernetes environments.

Detection Rules

FEATURE	DESCRIPTION
New and improved Analytics tags	New analytics suites: EDR Windows C2 Analytics: An innovative analytics detection suite that provides visibility into C2 and exfiltration traffic using our novel approach that fuses EDR process context and network-based features. This approach uncovers a broad range of attacks, from overt malicious communications to those involving seemingly benign implants or remote hosts. EDR Linux Shell Analytics: A new, advanced Analytics-based generic detection suite that detects abnormal Linux shell executions, surfacing unknown exploits, stealthy backdoors, and post-exploitation activities. It also highlights attacker tools and powerful system commands run in unfamiliar contexts. EDR MacOS Shell Analytics: A novel analytics-based detection suite tailored to the macOS domain that detects unusual spawned macOS shells. It uncovers unknown exploits, stealthy backdoors, and the uncommon AppleScript and information-gathering activities commonly leveraged by macOS infostealers. Improved analytics tags: NDR Lateral Movement Analytics: Upgrade to our network-based lateral movement detection suite, focusing on richer application logging for deeper protocol-based context. The suite's enhanced behavior-based analytics now provide earlier, more precise lateral movement detection, including SSH and improved Windows-native protocols. EDR macOS AppleScript Analytics: Expanding our AppleScript attacks coverage by introducing visibility into module events.This enhancement extends our detection of suspicious AppleScript executions to trigger alerts also on executables loading AppleScript dynamic libraries (dylibs) for potential malicious use.
Improved Analytics Insights	View the full list of detections behind the analytics and behavioral indicators of compromise (BIOCs) directly in the Cortex XDR console, so you can instantly understand why alerts were triggered.

Broker VM

Version 28.0.96 (reboot required)

For more information on maintenance releases, see Maintenance Releases

Deprecation of Broker VM Pathfinder applet

The Broker VM Pathfinder applet is now deprecated.

• From this release, the Pathfinder applet can no longer be activated in new tenants or existing tenants that have never implemented this applet before.

• If this applet has been implemented in your tenant, it will remain available until January 25, 2026, which is the official deprecation date. To ensure complete coverage and protection, we recommend deploying XDR Agents on all endpoints by this date.

• Migration guidance and deployment resources for XDR Agents are available here.

• For questions or transition support, contact your Customer Support team.

FEATURE	DESCRIPTION
Broker VM applet configurations preserved when deactivated	Cortex XDR now provides the ability to maintain the Broker VM applet configurations whenever an applet is deactivated. This ensures that whenever the applet is reactivated the saved configuration is restored.
Enhanced error visibility and auditing for additional Broker VM applets	Gain better insight into application, connectivity, and processing errors for the File and DB collector applets running on Broker VMs. Error messages are displayed on Apps of Broker VMs and Clusters, and applet status changes are logged in the collection_auditing dataset, enabling detailed investigations through XQL queries.

XDR Collectors

XDR Collectors 1.5.0: Windows 1.5.0.1733 and Linux 1.5.0.1695

XDR Collectors 1.4.3: Windows 1.4.3.1686

For more information on maintenance releases, see Maintenance Releases

Feature	Description
XDR Collectors 1.5.0 and 1.4.3	This release includes performance improvements and bug fixes.

External Data Ingestion and Management

FEATURE	DESCRIPTION
VNET flow log support for Azure Network Watcher	Azure Network Watcher now supports VNET flow logs.

Cortex Query Language (XQL)

FEATURE	DESCRIPTION
New XQL IP functions (Requires a Cortex XDR Pro license)	Cortex Query Language (XQL) now supports new functions for IP manipulations. These functions verify whether an input is a valid IPv4/IPv6 address and if the IPv4/IPv6 address is a known private IP.

Gateway

FEATURE	DESCRIPTION
Improved user record management	Only users with at least one role or user group assigned are saved to Cortex Gateway, ensuring that the Gateway contains only relevant user data. This enhances data security and system efficiency.

Investigation and Response

FEATURE	DESCRIPTION
Unified Identity Inventory	A unified inventory for identities features dedicated sections for investigating each domain: cloud, enterprise, and code.

Endpoint Security

FEATURE	DESCRIPTION
Cloud-based host policies	Cortex XDR with agent 8.9 and later, enables cloud-based hosts to define policies based on important cloud attributes, such as cluster name, region, and provider. This gives the capability to define different security policies based on geography, responsibility, or specific clusters.
VBScript enhancement	Cortex XDR with agent 8.9 and later, supports the ability to detect malicious VBScript files being written to disk.